A formal proof of a necessary and sufficient condition for deadlock-free adaptive networks Interactive Theorem Proving Freek Verbeek & Julien Schmaltz

Deadlocks: circular wait

Deadlocks: resources

Deadlocks: dependencies A B

Resource dependency graph

Deadlocks: circular wait? A B C

Resource dependency graph

Necessary and sufficient condition A cyclic dependency graph is only sufficient Duato was the first to define a necessary and sufficient condition Duato’s theorem was “complex, counter- intuitive and disruptive”

Necessary and sufficient condition A cyclic dependency graph is only sufficient Duato was the first to define a necessary and sufficient condition Duato’s theorem was “complex, counter- intuitive and disruptive” A simple, easy to understand and formally proven correct condition for adaptive routing.

Necessary and sufficient condition A network is deadlock-free if and only if all sets of cycles have an escape.

Escape A B C

No escape A B C

Necessary and sufficient condition All sets of cycles must have an escape. No deadlock Deadlock No deadlock

Necessary and sufficient condition All sets of cycles must have an escape No deadlock

Necessary and sufficient condition No deadlock

Interconnection Networks Interconnection network consists of: – Nodes n0n0 n1n1 n2n2 n4n4 n3n3 n5n5

Interconnection Networks Interconnection network consists of: – Nodes – Channels n0n0 n1n1 n2n2 n4n4 n3n3 n5n5 c0c0 c1c1 c5c5 c6c6 c2c2 c3c3 c4c4

Interconnection Networks Interconnection network consists of: – Nodes – Channels – Routing function n0n0 n1n1 n2n2 n4n4 n3n3 n5n5 c0c0 c1c1 c5c5 c6c6 c2c2 c3c3 c4c4 R(n 0,n 5 )=c 0 R(n 1,n 5 )={c 3, c 1 }

Interconnection Networks Interconnection network consists of: – Nodes – Channels – Routing function – Packet switching n0n0 n1n1 n2n2 n4n4 n3n3 n5n5 c0c0 c1c1 c5c5 c6c6 c2c2 c3c3 c4c4

Formalization of deadlock A configuration σ is a list of messages and their current channels. n0n0 n1n1 n2n2 n4n4 n3n3 n5n5 c0c0 c1c1 c5c5 c6c6 c2c2 c3c3 c4c4 MessageDestinationCurrent channe l n5n5 c0c0 n2n2 c0c0 n1n1 c6c6 Network:Configuration:

Formalization of deadlock A deadlock is a configuration where all messages are stuck. n0n0 n1n1 n2n2 n4n4 n3n3 n5n5 c0c0 c1c1 c5c5 c6c6 c2c2 c3c3 c4c4

Formalization of deadlock A deadlock is a configuration where all messages are stuck. A message is stuck if all its next hops are unavailable. n0n0 n1n1 n2n2 n4n4 n3n3 n5n5 c0c0 c1c1 c5c5 c6c6 c2c2 c3c3 c4c4

Formalization of deadlock A deadlock is a configuration where all messages are stuck. A message is stuck if all its next hops are unavailable. ((encapsulate (((unav * *) => *)) (((dl *) => *)) (defthm deadlock unav-next-hops (iff (dl σ) (unav (next-hops (msgs σ)) σ))) (defthm unav==>free-channel (implies (unav channels σ) (free channels σ))))

Formalization of deadlock A network is deadlock-free iff there exists no deadlock-configuration. (defun-sk E-deadlock (exists (σ) (and (legal-configp σ) (deadlock-configp σ))))

Formalization of condition (defun-sk A-cycles-E-escape (forall (cycles) (implies (and (consp cycles) (dep-cyclesp cycles)) (E-escape cycles)))) (defun-sk E-escape (cycles) (exists (channel) (and (member channel cycles) (A-dests-E-neighbor-outside channel cycles))

Formalization of condition (defthm correctness-of-condition (iff (not (E-deadlock)) (A-cycles-E-escape)))

Proof of correctness Condition --> Deadlock: – Define function that creates a legal deadlock from a set of cycles without an escape: – Proof correctness of this function. MessageDestinationCurrent channe l m0m0 d0d0 c0c0 m1m1 d1d1 c1c1 m2m2 d2d2 c2c2

Proof of correctness Deadlock --> Condition: – Define function that creates a set of cycles without an escape from a deadlock: – Proof correctness of this function. MessageDestinationCurrent channe l m0m0 d0d0 c0c0 m1m1 d1d1 c1c1 m2m2 d2d2 c2c2

Conclusions A correct, simple and formal condition for adaptive routing in packet switching networks Formal proof helped us understanding Duato’s condition Used defun-sk and defspec to elegantly define theorems Application: turn model in 2D Meshes

Future work Do a similar proof for wormhole networks Create a formally verified algorithm deciding deadlock-freedom

Questions?

Second order existential quantification A defspec construct does second order universal quantification Our approach: represent function f in an alist.

Second order existential quantification Given domain D and predicate p: (defun-sk A-x-in-D-p (f D) (forall (x) (implies (member x D) (p (cdr (assoc f x)))))) (defun-sk E-f-st-A-x-in-D-p (D) (exists f (and (alistp f) (A-x-in-D-p (f D)))))